drobo records

15 published records for vendor drobo.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 3
With a fix record: 0%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

15 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
48Plan	CVE-2018-14699Proof of concept	System command injection in the /DroboAccess/enable_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackerdrobo · 5n2 firmware · CWE-78 pre-auth RCE Command injection	Critical9.8	—	29.3%	Dec 3, 2018
45Plan	CVE-2018-14701No exploit	System command injection in the /DroboAccess/delete_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackerdrobo · 5n2 firmware · CWE-78 pre-auth RCE Command injection	Critical9.8	—	19.9%	Dec 3, 2018
44Plan	CVE-2018-14706No exploit	System command injection in the /DroboPix/api/drobopix/demo endpoint on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attacdrobo · 5n2 firmware · CWE-78 pre-auth RCE Command injection	Critical9.8	—	17.1%	Dec 3, 2018
40Plan	CVE-2018-14709No exploit	Incorrect access control in the Dashboard API on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to bypass authentication due to indrobo · 5n2 firmware · CWE-287 Pre-auth Auth bypass	Critical9.8	—	1.9%	Dec 3, 2018
40Plan	CVE-2018-14705No exploit	Lack of Authentication/Authorization on Administrative Web Pagesdrobo · 5n2 firmware · CWE-287 Pre-auth Auth bypass	Critical9.8	—	1.8%	Feb 24, 2020
39Monitor	CVE-2018-14703No exploit	Incorrect access control in the /mysql/api/droboapp/data endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackerdrobo · 5n2 firmware · CWE-732 Pre-auth	Critical9.8	—	1.3%	Dec 3, 2018
39Monitor	CVE-2018-14708No exploit	An insecure transport protocol used by Drobo Dashboard API on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to intercept network drobo · 5n2 firmware · CWE-287 Pre-auth Auth bypass	Critical9.8	—	1.2%	Dec 3, 2018
38Monitor	CVE-2018-14707No exploit	Directory traversal in the Drobo Pix web application on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to upload fdrobo · 5n2 firmware · CWE-22 Pre-auth Path traversal	High7.5	—	27.8%	Dec 3, 2018
30Monitor	CVE-2018-14702No exploit	Incorrect access control in the /drobopix/api/drobo.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackersdrobo · 5n2 firmware · CWE-200 Pre-auth Info leak	High7.5	—	1.3%	Dec 3, 2018
30Monitor	CVE-2018-14696No exploit	Incorrect access control in the /mysql/api/drobo.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers todrobo · 5n2 firmware · CWE-200 Pre-auth Info leak	High7.5	—	1.3%	Dec 3, 2018
30Monitor	CVE-2018-14700No exploit	Incorrect access control in the /mysql/api/logfile.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers drobo · 5n2 firmware · CWE-532 Pre-auth Info leak	High7.5	—	1.3%	Dec 3, 2018
30Monitor	CVE-2018-14695No exploit	Incorrect access control in the /mysql/api/diags.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers todrobo · 5n2 firmware · CWE-200 Pre-auth Info leak	High7.5	—	1.3%	Dec 3, 2018
24Monitor	CVE-2018-14704No exploit	Cross-site scripting in the MySQL API error page in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScript via a maldrobo · 5n2 firmware · CWE-79 Pre-auth XSS	Medium6.1	—	0.7%	Dec 3, 2018
24Monitor	CVE-2018-14698No exploit	Cross-site scripting in the /DroboAccess/delete_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScrdrobo · 5n2 firmware · CWE-79 Pre-auth XSS	Medium6.1	—	0.7%	Dec 3, 2018
24Monitor	CVE-2018-14697No exploit	Cross-site scripting in the /DroboAccess/enable_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScrdrobo · 5n2 firmware · CWE-79 Pre-auth XSS	Medium6.1	—	0.7%	Dec 3, 2018

CVE-2018-14699
48Plan
System command injection in the /DroboAccess/enable_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attacker
CriticalCVSS 9.8Proof of conceptEPSS 29%
- pre-auth RCE
- Command injection
drobo · 5n2 firmwareDec 3, 2018
CVE-2018-14701
45Plan
System command injection in the /DroboAccess/delete_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attacker
CriticalCVSS 9.8No exploitEPSS 19%
- pre-auth RCE
- Command injection
drobo · 5n2 firmwareDec 3, 2018
CVE-2018-14706
44Plan
System command injection in the /DroboPix/api/drobopix/demo endpoint on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attac
CriticalCVSS 9.8No exploitEPSS 17%
- pre-auth RCE
- Command injection
drobo · 5n2 firmwareDec 3, 2018
CVE-2018-14709
40Plan
Incorrect access control in the Dashboard API on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to bypass authentication due to in
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- Auth bypass
drobo · 5n2 firmwareDec 3, 2018
CVE-2018-14705
40Plan
Lack of Authentication/Authorization on Administrative Web Pages
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- Auth bypass
drobo · 5n2 firmwareFeb 24, 2020
CVE-2018-14703
39Monitor
Incorrect access control in the /mysql/api/droboapp/data endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attacker
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
drobo · 5n2 firmwareDec 3, 2018
CVE-2018-14708
39Monitor
An insecure transport protocol used by Drobo Dashboard API on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to intercept network
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- Auth bypass
drobo · 5n2 firmwareDec 3, 2018
CVE-2018-14707
38Monitor
Directory traversal in the Drobo Pix web application on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to upload f
HighCVSS 7.5No exploitEPSS 27%
- Pre-auth
- Path traversal
drobo · 5n2 firmwareDec 3, 2018
CVE-2018-14702
30Monitor
Incorrect access control in the /drobopix/api/drobo.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Info leak
drobo · 5n2 firmwareDec 3, 2018
CVE-2018-14696
30Monitor
Incorrect access control in the /mysql/api/drobo.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Info leak
drobo · 5n2 firmwareDec 3, 2018
CVE-2018-14700
30Monitor
Incorrect access control in the /mysql/api/logfile.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Info leak
drobo · 5n2 firmwareDec 3, 2018
CVE-2018-14695
30Monitor
Incorrect access control in the /mysql/api/diags.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Info leak
drobo · 5n2 firmwareDec 3, 2018
CVE-2018-14704
24Monitor
Cross-site scripting in the MySQL API error page in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScript via a mal
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
drobo · 5n2 firmwareDec 3, 2018
CVE-2018-14698
24Monitor
Cross-site scripting in the /DroboAccess/delete_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScr
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
drobo · 5n2 firmwareDec 3, 2018
CVE-2018-14697
24Monitor
Cross-site scripting in the /DroboAccess/enable_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScr
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
drobo · 5n2 firmwareDec 3, 2018